PT-2026-23696 · Unknown · Tina4 Stack

CVE-2018-25186 · Publicado 2026-03-06 · Atualizado 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tina4 Stack version 1.0.3

Description The software contains a cross-site request forgery issue that enables attackers to alter admin user credentials. This is achieved by submitting crafted POST requests to the /kim/profile endpoint. Attackers can create HTML forms that target this endpoint, including hidden fields with malicious data such as passwords and email addresses, to update administrator accounts without proper authentication. The profile endpoint is susceptible to forged requests.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-25186

Produtos afetados

Tina4 Stack

Referências · 5

• 🔥 https://exploit-db.com/exploits/45834 · Exploit
• https://vulncheck.com/advisories/tina-stack-cross-site-request-forgery-via-profile · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-25186 · Nota de Segurança
• https://t.me/CVEtracker/46601 · Publicação no Telegram
• https://t.me/cveNotify/155548 · Publicação no Telegram